It’s the second Tuesday of the month, so it’s once again time to play Patch Or Else, brought to you by Microsoft and Adobe.
It’s easy to get complacent about updating software: diligently installing updates as soon as they become available is an essential part of a good security strategy, and it means you’re less likely to fall afoul of malicious activity. But it also means that after a while you can lose sight of the risk of not staying up to date, and gradually become lax about installing updates. History is filled with stories of lost lessons; it’s apparently in our nature to forget what’s important when we aren’t reminded of the reasons for that importance.
Analysis of Microsoft’s Security Update Guide for the December 2018 updates reveals that this month we have sixty-seven distinct updates, half of which are flagged as having Critical severity. The updates address security issues in Adobe Flash (embedded in Internet Explorer and Edge), Internet Explorer, Edge, .NET, Office, Visual Studio, and Windows.
Update Windows and your other Microsoft software via Windows Update. In Windows 10, open the Start Menu and click on
Update & Security settings >
Windows Update. In older versions of Windows, you can find Windows Update in the Control Panel.
Presumably as part of the ongoing push for transparency in response to Windows 10 update problems earlier this year, Microsoft Corporate VP Michael Fortin posted an article, coinciding with this month’s updates, that explains some of the planning that goes into the monthly updates. Fortin points out that “During peak times, we update over 1,000 devices per second”.
Adobe’s contribution to the patch pile this month is a new version of Adobe Reader. The new Reader includes fixes for at least eighty-seven vulnerabilities, many having Critical severity. The release notes for Adobe Reader DC 2019.010.20064 provide additional details. Update Reader by pointing your browser to the Acrobat Reader Download Center.
Released on December 5th, the latest Flash addresses two security vulnerabilities in earlier versions. The security bulletin for Flash 188.8.131.52 provides additional details.
If you’re still using Flash, you should install the new version as soon as possible. If you use a web browser with a Flash plugin enabled, don’t wait: update now. If you’re not sure whether your browser has Flash enabled, visit the Flash Player Help page with that browser. The Help page will detect Flash in your browser, tell you which version is installed, and provide a download link for the latest version.
Web browsers that include their own embedded Flash will be updated via their usual channels: for Microsoft browsers, that means Windows Update. Chrome usually updates itself automatically, but you can trigger an update by navigating its menu to
About Google Chrome.
According to the release announcement, Chrome 71.0.3578.80 addresses forty-three distinct security vulnerabilities in earlier versions of the browser.
The full change log for the new version has over twelve thousand entries, none of which are mentioned in the announcement. Many of the changes appear to be fixes for minor bugs.
To check your version of Chrome, click its menu button and navigate to
About Google Chrome. If you’re not running the latest version, you’ll be able to update it from there.
There’s another new version of Flash: 184.108.40.206. A single Critical security vulnerability is addressed in this version. The vulnerability, when exploited, can allow for arbitrary code execution.
If you’re using a web browser with Flash enabled, you should update it as soon as possible. If you’re not sure whether your browser is enabled for Flash content, head over to the Flash Player Help page. If Flash is installed and enabled in your browser, your Flash version will be shown.
You can install Flash by visiting the main Flash installer page. Make sure to disable all the optional installation checkboxes on that page, or you’ll get unwanted software along with Flash.
As usual, Google Chrome and Microsoft’s browsers, which have their own embedded Flash viewers, are updated separately. Chrome will update itself; Edge and Internet Explorer are updated via the Windows Update service.
According to the release announcement for Chrome 70.0.3538.110, the new version fixes a single, High-severity security vulnerability. The change log lists a few additional bug fixes but nothing particularly interesting.
Chrome will update itself automatically on most computers, over the next few days or weeks. If that’s not soon enough for you, click the browser’s menu button at the top right (three vertical dots) and drill down to
About Google Chrome. This will show your current version and — usually — offer to install the latest version.
By now you’re probably aware that the push to connect everything to the Internet has been at the cost of security. Many IoT (Internet of Things) devices are poorly secured and can expose users to significant threats. I always encourage people to consider whether they really need their toaster to be connected to the Internet, and disable that feature if the answer is no.
Until recently, the IoT landscape was like the wild west, with little or no regulation of the security aspects of these devices.
But there’s reason for optimism, as reported by Bruce Schneier. Consumer Reports, the venerable consumer protection organization, is now testing the security of IoT devices, starting with home security cameras. Hopefully CR’s focus on security will be extended to other types of IoT devices soon.
Goverments are also waking up to the threat. California’s new SB 327 law, which will come into effect in 2020, will require that all network-connected devices meet basic security requirements. Other governing bodies are sure to follow, hopefully soon. Ultimately, we should have security standards for connected devices everywhere.
These efforts seem likely to get the attention of IoT device manufacturers, and encourage them to improve the security of their products. In particular, IoT devices need better security out of the box, with risky features disabled by default instead of enabled. Many devices are still shipped with well-known default passwords, and remote administration access enabled by default.
Last month, after users reported file deletion issues, Microsoft took the Windows 10 October Update offline. Yesterday, the (now fixed) update was again made available. Microsoft has slowed their rollout this time, and for now, you can only get the update by manually checking for updates in Windows Update. If there are no new problems, Microsoft will gradually push the update out to all Windows 10 computers over the coming weeks.
In the month since the October update was pulled, Microsoft did a lot of soul-searching (aka process review), and the results of that work, detailed in a November 13 blog post, make for interesting reading. Here are the highlights:
- Microsoft is trying to be more transparent about how it tests new versions of Windows before they are released. This is a good thing.
- Adequate testing is difficult because there are so many possible combinations of hardware and software being used on Windows 10.
- Base functional testing is the responsibility of the development teams. Presumably dedicated testing staff did this previously.
- Data and user feedback are being used to gauge quality.
- According to Microsoft, October update issues aside, overall quality and user satisfaction are increasing with each new Windows 10 update.
- Employees working on Windows 10 have to ‘eat their own dog food’, meaning that they are required to use Windows 10 themselves.
- As many as 15,000 new device drivers are added to Windows each month.
- “The first principle of a feature update rollout is to only update devices that our data shows will have a good experience.” I find this wording amusing: in this case a ‘good experience’ means one where you’re less likely to throw yourself off a building after trying to update your O/S.
This month, we have fifty-six updates from Microsoft. The updates fix security issues in .NET, Office, Internet Explorer, Edge, Microsoft Project, SharePoint, PowerShell, Skype, and Windows. Analysis of the Security Update Guide for this month shows that a total of sixty-three vulnerabilities are addressed by the updates. Twelve of the vulnerabilities are flagged as Critical.
Windows 10 computers will have relevant updates installed automatically over the next few days. Those of you running older versions of Windows that don’t have automatic updates enabled will need to use Windows Update (in the Windows Control Panel) to check for new updates.
Meanwhile, Adobe released new versions of Flash and Reader. Flash 220.127.116.11 addresses a single security vulnerability in earlier versions. Reader DC 2019.008.20081 fixes a single security bug in earlier versions. Adobe software will usually update itself, unless you’ve explicitly disabled its automatic update features.
Three security issues are fixed in the latest Chrome, released by Google on October 9. The Chrome 70.0.3538.102 change log is relatively brief, and the announcement doesn’t highlight any of the changes.
For most users, Chrome will update itself on its own mysterious schedule. You can regain some control by clicking Chrome’s ‘hamburger’ menu button and navigating to
About Google Chrome. This will show the version you’re currently runing and — usually — offer an update if it’s out of date.
Released on October 31, Thunderbird 60.3 fixes a handful of bugs — some of which are security-related — affecting multiple versions and platforms.
From the security advisory: In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts. What they seem to be saying is that these vulnerabilities cannot be exploited through the act of opening and reading email in Thunderbird. As for the part about browser-like contexts, well, that’s not at all clear. What contexts?
You can update your install of Thunderbird by clicking its hamburger menu button at the top right. Click the small arrow to the right of
Help, then click
About Mozilla Thunderbird. The About dialog should show your current version and offer an update if one is available.